﻿
// InjectorsDlg.cpp: 实现文件
//

#include "pch.h"
#include "framework.h"
#include "Injectors.h"
#include "InjectorsDlg.h"
#include "afxdialogex.h"
#include <TlHelp32.h>

#include "CreateRemoteThread.h"
#include "InjectDllByOEP.h"
#include "NtCreateThreadEx.h"
#include "InjectDllByRegistry.h"
#include "QueueUserApc.h"
#include "RtlCreateUserThread.h"
#include "SetThreadContext.h"
#include "SetWindowsHookEx.h"


#ifdef _DEBUG
#define new DEBUG_NEW
#endif


// 用于应用程序“关于”菜单项的 CAboutDlg 对话框

class CAboutDlg : public CDialogEx
{
public:
	CAboutDlg();

// 对话框数据
#ifdef AFX_DESIGN_TIME
	enum { IDD = IDD_ABOUTBOX };
#endif

	protected:
	virtual void DoDataExchange(CDataExchange* pDX);    // DDX/DDV 支持

// 实现
protected:
	DECLARE_MESSAGE_MAP()
};

CAboutDlg::CAboutDlg() : CDialogEx(IDD_ABOUTBOX)
{
}

void CAboutDlg::DoDataExchange(CDataExchange* pDX)
{
	CDialogEx::DoDataExchange(pDX);
}

BEGIN_MESSAGE_MAP(CAboutDlg, CDialogEx)
END_MESSAGE_MAP()


// CInjectorsDlg 对话框
CInjectorsDlg::CInjectorsDlg(CWnd* pParent /*=nullptr*/) : CDialogEx(IDD_INJECTORS_DIALOG, pParent)
{
	m_hIcon = AfxGetApp()->LoadIcon(/*IDR_MAINFRAME*/ IDI_MONITOR_ICO);
}

void CInjectorsDlg::DoDataExchange(CDataExchange* pDX)
{
	CDialogEx::DoDataExchange(pDX);
	DDX_Control(pDX, IDC_MFCEDITBROWSE_DLL, m_dll_edit);
	DDX_Control(pDX, IDC_BUTTON_GETPROCESS, m_get_prs_btn);
	DDX_Control(pDX, IDC_BUTTON_REMOTE, m_remote_btn);
	DDX_Control(pDX, IDC_LIST_PROCESS, m_list);
	DDX_Control(pDX, IDC_BUTTON_OPE, m_ope_btn);
	DDX_Control(pDX, IDC_BUTTON_NT, m_nt_btn);
	DDX_Control(pDX, IDC_BUTTON_APC, m_apc_btn);
	DDX_Control(pDX, IDC_BUTTON_REGISTER, m_register_btn);
	DDX_Control(pDX, IDC_BUTTON_RTL, m_rtl_btn);
	DDX_Control(pDX, IDC_BUTTON_CTX, m_ctx_btn);
	DDX_Control(pDX, IDC_BUTTON_HOOK, m_hook_btn);
}

BEGIN_MESSAGE_MAP(CInjectorsDlg, CDialogEx)
	ON_WM_SYSCOMMAND()
	ON_WM_PAINT()
	ON_WM_QUERYDRAGICON()
	ON_BN_CLICKED(IDC_BUTTON_GETPROCESS, &CInjectorsDlg::OnBnClickedButtonGetprocess)
	ON_BN_CLICKED(IDC_BUTTON_REMOTE, &CInjectorsDlg::OnBnClickedButtonALL)
	ON_BN_CLICKED(IDC_BUTTON_OPE, &CInjectorsDlg::OnBnClickedButtonALL)
	ON_BN_CLICKED(IDC_BUTTON_NT, &CInjectorsDlg::OnBnClickedButtonALL)
	ON_BN_CLICKED(IDC_BUTTON_APC, &CInjectorsDlg::OnBnClickedButtonALL)
	ON_BN_CLICKED(IDC_BUTTON_REGISTER, &CInjectorsDlg::OnBnClickedButtonALL)
	ON_BN_CLICKED(IDC_BUTTON_RTL, &CInjectorsDlg::OnBnClickedButtonALL)
	ON_BN_CLICKED(IDC_BUTTON_CTX, &CInjectorsDlg::OnBnClickedButtonALL)
	ON_BN_CLICKED(IDC_BUTTON_HOOK, &CInjectorsDlg::OnBnClickedButtonALL)
END_MESSAGE_MAP()


// CInjectorsDlg 消息处理程序

BOOL CInjectorsDlg::OnInitDialog()
{
	CDialogEx::OnInitDialog();

	// 将“关于...”菜单项添加到系统菜单中。

	// IDM_ABOUTBOX 必须在系统命令范围内。
	ASSERT((IDM_ABOUTBOX & 0xFFF0) == IDM_ABOUTBOX);
	ASSERT(IDM_ABOUTBOX < 0xF000);

	CMenu* pSysMenu = GetSystemMenu(FALSE);
	if (pSysMenu != nullptr)
	{
		BOOL bNameValid;
		CString strAboutMenu;
		bNameValid = strAboutMenu.LoadString(IDS_ABOUTBOX);
		ASSERT(bNameValid);
		if (!strAboutMenu.IsEmpty())
		{
			pSysMenu->AppendMenu(MF_SEPARATOR);
			pSysMenu->AppendMenu(MF_STRING, IDM_ABOUTBOX, strAboutMenu);
		}
	}

	// 设置此对话框的图标。  当应用程序主窗口不是对话框时，框架将自动
	//  执行此操作
	SetIcon(m_hIcon, TRUE);			// 设置大图标
	SetIcon(m_hIcon, FALSE);		// 设置小图标

	// 设置表格
	CRect rect;
	m_list.GetClientRect(&rect);
	int col_width = (rect.Width()) / 8;
	m_list.SetExtendedStyle(LVS_EX_FULLROWSELECT | LVS_EX_GRIDLINES); // 整行选择、网格线
	m_list.InsertColumn(0, _T("ID"), LVCFMT_LEFT, col_width);// 插入第1列的列名
	m_list.InsertColumn(1, _T("PID"), LVCFMT_LEFT, col_width * 2); // 插入第2列的列名
	m_list.InsertColumn(2, _T("应用"), LVCFMT_LEFT, col_width * 4); // 插入第3列的列名

	return TRUE;  // 除非将焦点设置到控件，否则返回 TRUE
}

void CInjectorsDlg::OnSysCommand(UINT nID, LPARAM lParam)
{
	if ((nID & 0xFFF0) == IDM_ABOUTBOX)
	{
		CAboutDlg dlgAbout;
		dlgAbout.DoModal();
	}
	else
	{
		CDialogEx::OnSysCommand(nID, lParam);
	}
}

// 如果向对话框添加最小化按钮，则需要下面的代码
//  来绘制该图标。  对于使用文档/视图模型的 MFC 应用程序，
//  这将由框架自动完成。

void CInjectorsDlg::OnPaint()
{
	if (IsIconic())
	{
		CPaintDC dc(this); // 用于绘制的设备上下文

		SendMessage(WM_ICONERASEBKGND, reinterpret_cast<WPARAM>(dc.GetSafeHdc()), 0);

		// 使图标在工作区矩形中居中
		int cxIcon = GetSystemMetrics(SM_CXICON);
		int cyIcon = GetSystemMetrics(SM_CYICON);
		CRect rect;
		GetClientRect(&rect);
		int x = (rect.Width() - cxIcon + 1) / 2;
		int y = (rect.Height() - cyIcon + 1) / 2;

		// 绘制图标
		dc.DrawIcon(x, y, m_hIcon);
	}
	else
	{
		CDialogEx::OnPaint();
	}
}

//当用户拖动最小化窗口时系统调用此函数取得光标
//显示。
HCURSOR CInjectorsDlg::OnQueryDragIcon()
{
	return static_cast<HCURSOR>(m_hIcon);
}

void CInjectorsDlg::OnBnClickedButtonGetprocess()
{
	// 清空列表
	m_list.DeleteAllItems();

	HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
	if (hSnapshot == INVALID_HANDLE_VALUE)
	{
		AfxMessageBox(TEXT("创建快照失败"));
		return;
	}

	PROCESSENTRY32 pe;
	pe.dwSize = sizeof(PROCESSENTRY32);
	if (FALSE == Process32First(hSnapshot, &pe))
	{
		AfxMessageBox(TEXT("枚举进程失败"));
		return;
	}

	//TCHAR* szBit = L"";
	TCHAR szProcessString[MAX_PATH];
	int index = 0;
	while (Process32Next(hSnapshot, &pe))
	{
		SYSTEM_INFO systemInfo;
		GetNativeSystemInfo(&systemInfo);
		/*if (systemInfo.wProcessorArchitecture == PROCESSOR_ARCHITECTURE_AMD64)
		{
			HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, pe.th32ProcessID);
			if (NULL == hProcess)
				continue;
			BOOL pBool;
			BOOL IsWow64 = IsWow64Process(hProcess, &pBool);
			szBit = IsWow64 ? TEXT("32位") : TEXT("64位");
		}
		else if (systemInfo.wProcessorArchitecture == PROCESSOR_ARCHITECTURE_INTEL)
		{
			szBit = TEXT("32位");
		}
		else
		{
			szBit = TEXT("未知");
		}*/
		
		m_list.InsertItem(index, L"");
		CString id_str = L"";
		id_str.Format(L"%d", index + 1);
		m_list.SetItemText(index, 0, id_str);
		CString pid_str = L"";
		pid_str.Format(L"%d", pe.th32ProcessID);
		m_list.SetItemText(index, 1, pid_str);
		swprintf_s(szProcessString, TEXT("%ls"), pe.szExeFile);
		m_list.SetItemText(index, 2, szProcessString);
		index++;
	}
	CloseHandle(hSnapshot);
}

void CInjectorsDlg::OnBnClickedButtonALL()
{
	int i = m_list.GetSelectionMark();
	int pid = _ttoi(m_list.GetItemText(i, 1));
	if (pid == 0)
	{
		AfxMessageBox(TEXT("请选择进程"));
		return;
	}

	CString path;
	GetDlgItemText(IDC_MFCEDITBROWSE_DLL, path);
	if (path == "")
	{
		AfxMessageBox(TEXT("请选择DLL"));
		return;
	}

	BOOL res = FALSE;
	int ctrlid = GetFocus()->GetDlgCtrlID();
	if (ctrlid == m_remote_btn.GetDlgCtrlID())
		res = CreateRemoteThread(pid, cs2str(path));
	else if (ctrlid == m_ope_btn.GetDlgCtrlID())
		res = InjectDllByOEP(pid, cs2str(path));
	else if (ctrlid == m_apc_btn.GetDlgCtrlID())
		res = InjectByQueueUserApc(pid, cs2str(path));
	else if (ctrlid == m_nt_btn.GetDlgCtrlID())
		res = NtCreateThreadEx(pid, cs2str(path));
	else if (ctrlid == m_register_btn.GetDlgCtrlID())
		res = InjectByRegistry(pid, cs2str(path));
	else if (ctrlid == m_rtl_btn.GetDlgCtrlID())
		res = InjectDllByRtl(pid, cs2str(path));
	else if (ctrlid == m_ctx_btn.GetDlgCtrlID())
		res = InjectByWThreadContext(pid, cs2str(path));
	else if (ctrlid == m_hook_btn.GetDlgCtrlID())
		res = InjectByHookEx(pid, cs2str(path));
	AfxMessageBox(res ? TEXT("注入成功") : TEXT("注入失败"));
}
